BharatMLStack versions up to 1.3.0 contain an unsanitized rendering of user‑supplied data in the Trufflebox UI component, ExpressionViewModal.jsx, which, based on the description, allows attackers to inject arbitrary scripts that run in the browser context of any user who opens the modal. The resulting Cross‑Site Scripting flaw can lead to session hijacking, credential theft, or other client‑side attacks. The weakness corresponds to CWE‑79.

The affected product is BharatMLStack, with all releases up to and including version 1.3.0. No other vendors or products are listed in the CNA data. Users running 1.3.0 or earlier are considered vulnerable.

The CVSS base score is not provided in the available data, yet an XSS flaw generally imposes a high risk of client‑side compromise. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that a threat actor can supply malicious content persuade or trick a user to open the ExpressionViewModal. Upon rendering, the injected script would execute within the victim’s browser context, allowing the attacker to perform actions with the victim’s privileges.